@bobfrankston/npmglobalize 1.0.169 → 1.0.171

package/cli.js

@@ -37,6 +37,12 @@ Dependency Options:
   -publish-deps            Auto-publish file: dependencies (default)
   -pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
   -no-publish-deps, -npd   Don't auto-publish file: dependencies (use with caution)
+  -public-deps             Cascade npmVisibility:"public" to all transitive workspace/file:
+                           deps. In workspace mode: auto-promotes every reachable workspace
+                           member without prompting (writes npmVisibility:"public" into each
+                           dep's .globalize.json5). In single-package mode: also propagates
+                           public visibility to already-published deps in the cascade.
+                           Use when a public consumer's deps weren't all marked public.
   -no-prescan, -nps        Skip upfront dep-graph prescan
   -force-publish           Republish dependencies even if version exists
   -fix                     Run npm audit fix after transformation
@@ -298,6 +304,9 @@ function parseArgs(args) {
             case '-npd':
                 options.publishDeps = false; // Disable auto-publishing
                 break;
+            case '-public-deps':
+                options.publicDeps = true;
+                break;
             case '-no-use-paths':
             case '-nup':
                 options.usePaths = false; // Skip sibling-path resolution; use latest npm version for file: deps

package/lib/config.js

@@ -65,7 +65,7 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
-    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'forcePublish', 'once', 'cleanNestedModules']);
+    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
             continue;

package/lib/types.d.ts

@@ -54,6 +54,8 @@ export interface GlobalizeOptions {
     publishDeps?: boolean;
     /** Auto-yes to dep-cascade prompts (add scope for private); does NOT auto-yes public prompts */
     publishDepsYes?: boolean;
+    /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting. */
+    publicDeps?: boolean;
     /** Skip the upfront dep-graph prescan */
     noPrescan?: boolean;
     /** Force republish dependencies even if version exists on npm */

package/lib.d.ts

@@ -73,6 +73,12 @@ export interface GlobalizeOptions {
     publishDeps?: boolean;
     /** Auto-yes to dep-cascade prompts (add scope to make private, etc.); does NOT auto-yes public prompts */
     publishDepsYes?: boolean;
+    /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting.
+     *  In workspace mode: fixpoint-promotes every workspace member reachable from a public consumer.
+     *  In single-package mode: drops the "first publish only" guard so already-published deps also
+     *  get the parent's npmVisibility propagated. Use to fix a workspace where a public member's
+     *  deps weren't all marked public (and the published tarball would 404 on install). */
+    publicDeps?: boolean;
     /** Force republish dependencies even if version exists on npm */
     forcePublish?: boolean;
     /** Run npm audit and fix vulnerabilities */
@@ -165,6 +171,24 @@ export declare function checkVersionExists(packageName: string, version: string)
 export declare function checkPackageExists(packageName: string): boolean;
 /** Check npm package access level (public/restricted/null if not published) */
 export declare function checkNpmAccess(packageName: string): 'public' | 'restricted' | null;
+/** Walk `file:` deps transitively from a starting directory and ensure each is set
+ *  up to be installable from a public consumer: persists `npmVisibility:"public"` in
+ *  each dep's `.globalize.json5`, and flips npm access from `restricted` to `public`
+ *  for any dep that's already on npm. Returns blockers for deps that can't be made
+ *  public (private:true or noPublish:true). Used by single-package `-public-deps`
+ *  to handle deps that are unchanged locally — those would otherwise be skipped by
+ *  the cascade and stay private on npm. */
+export declare function cascadePublicVisibility(cwd: string, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<{
+    promoted: string[];
+    configWritten: string[];
+    blockers: Array<{
+        name: string;
+        reason: string;
+    }>;
+}>;
 /** Check if public package has private/inaccessible dependencies */
 export declare function checkPrivateDependencies(pkg: any, verbose?: boolean): {
     name: string;

package/lib.js

@@ -238,7 +238,7 @@ export function writeConfig(dir, config, explicitKeys) {
     const existing = readConfig(dir);
     // Filter out temporary flags and default values (unless explicitly set)
     const filtered = {};
-    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'forcePublish', 'once', 'cleanNestedModules']);
+    const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
             continue;
@@ -565,6 +565,113 @@ export function checkNpmAccess(packageName) {
         return null;
     }
 }
+/** Walk `file:` deps transitively from a starting directory and ensure each is set
+ *  up to be installable from a public consumer: persists `npmVisibility:"public"` in
+ *  each dep's `.globalize.json5`, and flips npm access from `restricted` to `public`
+ *  for any dep that's already on npm. Returns blockers for deps that can't be made
+ *  public (private:true or noPublish:true). Used by single-package `-public-deps`
+ *  to handle deps that are unchanged locally — those would otherwise be skipped by
+ *  the cascade and stay private on npm. */
+export async function cascadePublicVisibility(cwd, opts = {}) {
+    const { dryRun = false, verbose = false } = opts;
+    const promoted = [];
+    const configWritten = [];
+    const blockers = [];
+    const visited = new Set();
+    const processed = new Set(); // dedupe by package name across diamond deps
+    async function walk(dir) {
+        let real;
+        try {
+            real = fs.realpathSync(dir);
+        }
+        catch {
+            return;
+        }
+        if (visited.has(real))
+            return;
+        visited.add(real);
+        let pkg;
+        try {
+            pkg = readPackageJson(dir);
+        }
+        catch {
+            return;
+        }
+        for (const key of DEP_KEYS) {
+            // Use the .dependencies backup if present (has original file: refs).
+            const deps = pkg['.' + key] || pkg[key];
+            if (!deps)
+                continue;
+            for (const [name, value] of Object.entries(deps)) {
+                if (typeof value !== 'string' || !isFileRef(value))
+                    continue;
+                let targetPath;
+                try {
+                    targetPath = resolveFilePath(value, dir);
+                }
+                catch {
+                    continue;
+                }
+                if (!fs.existsSync(path.join(targetPath, 'package.json')))
+                    continue;
+                let targetPkg;
+                try {
+                    targetPkg = readPackageJson(targetPath);
+                }
+                catch {
+                    continue;
+                }
+                const targetName = targetPkg.name || name;
+                if (!processed.has(targetName)) {
+                    processed.add(targetName);
+                    if (targetPkg.private) {
+                        blockers.push({ name: targetName, reason: '"private": true in package.json (cannot publish to npm)' });
+                    }
+                    else {
+                        const targetConfig = readConfig(targetPath);
+                        if (targetConfig.noPublish) {
+                            blockers.push({ name: targetName, reason: 'noPublish:true in .globalize.json5' });
+                        }
+                        else {
+                            if (targetConfig.npmVisibility !== 'public') {
+                                if (!dryRun) {
+                                    targetConfig.npmVisibility = 'public';
+                                    writeConfig(targetPath, targetConfig, new Set(['npmVisibility']));
+                                }
+                                configWritten.push(targetName);
+                                if (verbose)
+                                    console.log(colors.dim(`  ${targetName}: npmVisibility:"public" written to .globalize.json5`));
+                            }
+                            const access = checkNpmAccess(targetName);
+                            if (access === 'restricted') {
+                                if (!dryRun) {
+                                    const r = runCommand('npm', ['access', 'set', 'status=public', targetName], { cwd: targetPath, silent: true });
+                                    if (r.success) {
+                                        promoted.push(targetName);
+                                        console.log(colors.green(`  ✓ Flipped ${targetName} to PUBLIC on npm`));
+                                    }
+                                    else {
+                                        blockers.push({ name: targetName, reason: `npm access set failed: ${r.stderr || r.output || 'unknown'}` });
+                                    }
+                                }
+                                else {
+                                    console.log(colors.dim(`  [dry-run] Would flip ${targetName} to PUBLIC on npm`));
+                                }
+                            }
+                            else if (access === 'public' && verbose) {
+                                console.log(colors.dim(`  ${targetName}: already PUBLIC on npm`));
+                            }
+                            // access === null: not on npm yet — the cascade publish step handles that.
+                        }
+                    }
+                }
+                await walk(targetPath);
+            }
+        }
+    }
+    await walk(cwd);
+    return { promoted, configWritten, blockers };
+}
 /** Check if public package has private/inaccessible dependencies */
 export function checkPrivateDependencies(pkg, verbose = false) {
     const privateDeps = [];
@@ -3108,6 +3215,7 @@ async function doLocalInstall(cwd, options) {
 export async function globalize(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
+    publicDeps = false, // -public-deps: cascade public visibility to all deps
     noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false, usePaths = true, allowTs } = options;
     // Show tool version only for recursive dep calls (CLI already prints it at startup)
     const toolVersion = getToolVersion();
@@ -3843,6 +3951,32 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.log(colors.dim(`Would add publishConfig.access: "public" to package.json`));
         }
     }
+    // -public-deps pre-pass: at the top of the user-invoked call, walk file: deps
+    // transitively and flip any that are already on npm but currently `restricted`
+    // to `public`, persisting `npmVisibility:"public"` in each dep's .globalize.json5.
+    // This handles the case where a public consumer's deps are unchanged locally
+    // (so the cascade publish step would skip them) but published as private —
+    // public installers would 404. Only runs once at the top level (suppressed in
+    // recursive cascade and workspace-orchestrated calls, which already handle this).
+    if (publicDeps && !options._fromDep && !options._fromWorkspace) {
+        console.log(colors.italic('-public-deps: walking file: deps to ensure all are PUBLIC on npm...'));
+        const result = await cascadePublicVisibility(cwd, { dryRun, verbose });
+        if (result.promoted.length === 0 && result.configWritten.length === 0 && verbose) {
+            console.log(colors.dim('  (no changes needed)'));
+        }
+        if (result.blockers.length > 0) {
+            console.log('');
+            console.log(colors.red('✗ -public-deps: cannot make every transitive dep public:'));
+            for (const b of result.blockers) {
+                console.log(colors.red(`  ${b.name}: ${b.reason}`));
+            }
+            if (!force) {
+                return false;
+            }
+            console.log(colors.yellow('Continuing with --force despite blockers...'));
+        }
+        console.log('');
+    }
     // Check for private dependencies in public packages
     const willBePublic = effectiveNpmVisibility === 'public' ||
         currentAccess === 'public' ||
@@ -3985,8 +4119,11 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     if (!dryRun) {
                         // Check if package has EVER been published to npm (any version)
                         const hasBeenPublished = checkPackageExists(name);
-                        // Recursively call globalize on the dependency
-                        // Only pass npmVisibility to truly NEW packages (never published before)
+                        // Recursively call globalize on the dependency.
+                        // Normally only pass npmVisibility to truly NEW packages (never published
+                        // before) — already-published deps keep their own visibility setting.
+                        // -public-deps overrides this: propagate npmVisibility regardless so a
+                        // public consumer's transitive deps all get promoted to public.
                         const depSuccess = await globalize(path, {
                             bump: 'patch', // Use existing version, don't bump
                             verbose,
@@ -3994,13 +4131,14 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             force,
                             files,
                             gitVisibility,
-                            npmVisibility: hasBeenPublished ? undefined : npmVisibility, // Only for new packages
+                            npmVisibility: (hasBeenPublished && !publicDeps) ? undefined : npmVisibility,
                             updateDeps,
                             updateMajor,
                             fix,
                             conform, // Propagate conform to dependencies
                             publishDeps, // Propagate so transitive deps also get published
                             publishDepsYes, // Propagate auto-yes through cascade
+                            publicDeps, // Propagate so transitive deps also get promoted to public
                             forcePublish, // Propagate so transitive deps get force-published too
                             _fromDep: true, // Suppress nested prescan
                             rebase, // Propagate so behind-remote deps get rebased automatically
@@ -5364,32 +5502,109 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
         }
     }
     const wsNameSet = new Set(packages.map(p => p.name));
-    for (const pkgInfo of packages) {
-        if (visibilityMap.get(pkgInfo.name) !== 'public')
-            continue;
-        const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
-        for (const depName of Object.keys(deps || {})) {
-            if (!wsNameSet.has(depName))
-                continue;
-            if (visibilityMap.get(depName) === 'public')
+    // Fixpoint: each promotion can expose new transitive deps (a newly-public B may
+    // itself depend on a private C). Iterate until no further promotions happen so
+    // chains like public A → private B → private C are fully resolved regardless of
+    // packages[] order.
+    {
+        let changed = true;
+        let guard = 0;
+        while (changed && guard++ < 50) {
+            changed = false;
+            for (const pkgInfo of packages) {
+                if (visibilityMap.get(pkgInfo.name) !== 'public')
+                    continue;
+                const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
+                for (const depName of Object.keys(deps || {})) {
+                    if (!wsNameSet.has(depName))
+                        continue;
+                    if (visibilityMap.get(depName) === 'public')
+                        continue;
+                    const depInfo = packages.find(p => p.name === depName);
+                    if (!depInfo)
+                        continue;
+                    console.log(colors.yellow(`⚠ Public package ${pkgInfo.name} depends on ${depName} which has no public visibility set.`));
+                    let makePublic = false;
+                    if (options.publicDeps) {
+                        console.log(colors.green(`  -public-deps: auto-promoting ${depName} to public`));
+                        makePublic = true;
+                    }
+                    else if (options.dryRun) {
+                        console.log(colors.dim(`  [dry-run] Would ask to make ${depName} public`));
+                    }
+                    else {
+                        makePublic = await confirm(`Make ${depName} public too?`, true);
+                    }
+                    if (makePublic) {
+                        if (!options.dryRun) {
+                            const depConfig = readConfig(depInfo.dir);
+                            depConfig.npmVisibility = 'public';
+                            writeConfig(depInfo.dir, depConfig, new Set(['npmVisibility']));
+                            console.log(colors.green(`✓ Set ${depName} to public in .globalize.json5`));
+                        }
+                        else {
+                            console.log(colors.dim(`  [dry-run] Would set ${depName} npmVisibility:"public"`));
+                        }
+                        visibilityMap.set(depName, 'public');
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    // Fail-loud: refuse to publish a public workspace member whose file: deps point
+    // at non-publishable workspace siblings (private:true, noPublish:true, or still
+    // not marked public after the prompt loop). A registry tarball declaring such
+    // deps would 404 on a clean install. See docs/npmglobalize-transitive-workspace-deps.md.
+    {
+        const allMembers = resolveAllWorkspacePackages(rootDir);
+        const memberByName = new Map();
+        for (const m of allMembers)
+            memberByName.set(m.name, m);
+        const blockers = [];
+        const filteredSet = new Set(filteredOrder);
+        for (const pkgInfo of packages) {
+            if (visibilityMap.get(pkgInfo.name) !== 'public')
                 continue;
-            const depInfo = packages.find(p => p.name === depName);
-            if (!depInfo)
+            // Only check members that will actually be processed this run.
+            if (!filteredSet.has(pkgInfo.name))
                 continue;
-            console.log(colors.yellow(`⚠ Public package ${pkgInfo.name} depends on ${depName} which has no public visibility set.`));
-            if (!options.dryRun) {
-                const makePublic = await confirm(`Make ${depName} public too?`, true);
-                if (makePublic) {
-                    const depConfig = readConfig(depInfo.dir);
-                    depConfig.npmVisibility = 'public';
-                    writeConfig(depInfo.dir, depConfig, new Set(['npmVisibility']));
-                    visibilityMap.set(depName, 'public');
-                    console.log(colors.green(`✓ Set ${depName} to public in .globalize.json5`));
+            const deps = { ...pkgInfo.pkg.dependencies, ...pkgInfo.pkg.devDependencies };
+            for (const [depName, depVal] of Object.entries(deps)) {
+                if (typeof depVal !== 'string')
+                    continue;
+                const member = memberByName.get(depName);
+                if (!member)
+                    continue; // External dep, not workspace-internal — out of scope.
+                if (member.pkg.private) {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} has "private": true in package.json (cannot publish)` });
+                    continue;
+                }
+                const depConfig = readConfig(member.dir);
+                if (depConfig.noPublish) {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} has noPublish:true in .globalize.json5` });
+                    continue;
+                }
+                if (visibilityMap.get(depName) !== 'public') {
+                    blockers.push({ pkg: pkgInfo.name, dep: depName, reason: `${depName} is not marked public (set npmVisibility:"public" in its .globalize.json5, or rerun with -public-deps)` });
+                    continue;
                 }
             }
-            else {
-                console.log(colors.dim(`  [dry-run] Would ask to make ${depName} public`));
+        }
+        if (blockers.length > 0) {
+            console.log('');
+            console.log(colors.red('✗ Refusing to publish: public workspace members depend on non-publishable siblings.'));
+            console.log(colors.red('  The published tarball would 404 on a clean install.'));
+            console.log('');
+            for (const b of blockers) {
+                console.log(colors.red(`  ${b.pkg} → ${b.dep}: ${b.reason}`));
             }
+            console.log('');
+            console.log(colors.dim('Fixes:'));
+            console.log(colors.dim('  - Set npmVisibility:"public" in each offending dep\'s .globalize.json5'));
+            console.log(colors.dim('  - Or rerun with -public-deps to auto-promote all transitive workspace deps'));
+            console.log(colors.dim('  - Or remove npmVisibility:"public" from the consumer (keep it bundled under the workspace root)'));
+            return { success: false, packages: [], publishOrder };
         }
     }
     // Sync workspace-root node_modules with member package.json files. Catches

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.169",
+  "version": "1.0.171",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",